Editing EDAT files

= Info on the talk page =

'''Info on the talk page''': please digest the info and move it here'''

= Location =

EDAT files are stored under .edat extension. They are often packed in NPDRM [[PKG files]], downloaded from PS Store then extracted to the PS3 HDD. There are also PSP EDAT files which have a different format (to document).

= Structure (Encrypted Format) =

== Header ==

{| class="wikitable" style="text-align: center;"
|-
! style="background-color:#ffffff; border-left:1px solid #ffffff; border-top:1px solid #ffffff;" |
! Offset
! Name
! Size
! Type
! Notes
|-
! rowspan="19" | Header
|-
| 0x00 || Magic || 4 || char[4] ||"NPD\0" (4E 50 44 00)
|-
| 0x04 || Version || 4 || uint32_t || ex: 1, 2, 3, 4. See [[#Footer]] for the precise packager version.
|-
| 0x08 || [[DRM Type]] || 4 || uint32_t || For PS2 EDAT, PS3 FW requires it to be with activation (also a.k.a. Paid content paired with your individual data) for [[PKG_files#Misc.2FNote|PS1 PKG]], PS3 FW 4.00 introduced some changes for installing them with regard to the EDAT DRM type.
|-
| 0x0C || [[App Types|Application Type]] || 4 || uint32_t ||
|-
| 0x10 || [[PARAM.SFO#CONTENT_ID|CONTENT ID]] || 0x30 || uint8_t[0x30] || Content ID (with padding to fit 48 bytes)
|-
| 0x40 || Digest || 0x10 || uint8[0x10] || QA digest (seems like to be a SHA-1 hash of the non-finalized file): hash of the original data which is unknown until the whole file is read, so it cannot be used as a check, however it can be used as watermark or zeroed on forged file.
|-
| 0x50 || NPD CID-FN Hash || 0x10 || uint8_t[0x10] || CID-FN hash. AES-CMAC hash of concatenation of Content ID (48 bytes) and EDAT file name (eg MINIS.EDAT) using the third [[Keys#NPDRM_OMAC_Keys|NPDRM OMAC key]] as AES-CMAC key. Example: aes_cmac(55 50 30 35 37 36 2D 4E 50 55 5A 30 30 31 34 39 5F 30 30 2D 56 41 4E 47 55 41 52 44 32 30 30 30 30 30 30 31 00 00 00 00 00 00 00 00 00 00 00 00 4D 49 4E 49 53 2E 45 44 41 54, npd_cid_fn_hash_omac_key).
|-
| 0x60 || NPD Header hash || 0x10 || uint8_t[0x10] || Header hash. AES CMAC hash of the 0x60 bytes from the beginning of the file using (klicensee XOR [[Keys#NPDRM_OMAC_Keys|second NPDRM OMAC key]] as AES-CMAC key.
|-
| 0x70 || Activation time || 8 || ?64-bit time or 32-bit padding? || Start of the validity period, filled with 00 if not used.
|-
| 0x78 || Expiration time || 8 || ?64-bit time or 32-bit padding? || End of the validity period, filled with 00 if not used.
|-
| 0x80 || NPD type || 1 || ?uint8_t? || (separated from Metadata type for wiki format)
*00: Finalized EDAT
*01: Finalized SDAT
*80: Non Finalized EDAT
*81: Non Finalized SDAT
|-
| 0x81 || Metadata type || 3 || ?uint8_t[3]? || (Outdated Flags description from talk page)
*00
*01: Compressed?
*02: Plain text?
*03: Compressed plain text?
*05: Compressed?
*06: Plain text?
*07: Compressed plain text?
*0C: ?
*0D: Compressed data?
*3C: Data/misc?
|-
| 0x84 || Segment size || 4 || uint32_t || Default block is 16 KB (16384 bytes) = 0x4000, max is 0x8000.
|-
| 0x88 || Data size || 8 || uint64_t || Decoded data size.
|-
| 0x90 || Meta data sections hash || 0x10 || uint8_t[0x10] || 
|-
| 0xA0 || Extended header hash || 0x10 || uint8_t[0x10] || AES-CMAC hash of 160 bytes from the beginning of file. It uses the hash key as AES-CMAC key and it depends on the file flags and keys. ?What does this mean?
|-
| 0xB0 || ECDSA Metadata signature || 0x28 || uint8_t[0x28] || Can be zeroed on forged file. curve_type is vsh type 0x02, pub is vsh public key,
|-
| 0xD8 || ECDSA Header signature || 0x28) || uint8_t[0x28] || Enabled (only?) for PS2 classic: all PS3 CFWs are patched to skip the ECDSA check. Can be zeroed on forged file. curve_type is vsh type 2, pub is vsh public key.
|-
! colspan=6 |      
|-
! rowspan="3" | Body
|-
| 0x100 || Encrypted file || Variable || uint8_t[variable] || The file is encrypted using an AES algorithm in CBC mode.
|-
| 0x** || Padding || Variable || uint8_t[variable] || Aligned on ?? bytes.
|}

== Footer ==

{| class="wikitable" style="text-align: center;"
|-
! Description || Size || Notes
|-
| Name || 5 || "EDATA" or "SDATA"
|-
| Space character || 1 || ' ' = 0x20
|-
| Packager Version || 8 ||
*Version 1: "packager"
*Version 2: "2.4.0.L "
*Version 2: "2.4.0.W "
*Version 2: "2.7.0.L "
*Version 3: "3.1.0.W "
*Version 3: "3.3.0.L "
*Version 3: "3.3.0.W "
*Version 4: "4.0.0.L "
*Version 4: "4.0.0.W "
|-
| Padding || 2 || 00 00
|}

= EDAT Versions =

There are 4 PS3 EDAT format major versions:
* 1: compatible with SDK 2.1x or older
* 2: compatible with SDK 3.0x or older
* 3: compatible with SDK 3.7x or older
* 4: compatible with SDK ?.?? or older. Certainly supported since some 4.0x FW.

= EDAT Decryption =

EDAT decryption requires a key, the licensee key or klicensee. Depending on the DRM type, klicensee is got in different ways:
* DRM type Network: klicensee is generated using rif + ?to detail?
* DRM type Local: klicensee is generated using act.dat + associated rif + console's IDPS
* DRM type Free: klicensee is the constant PS3 Free klicensee (see NPDRM [[Keys]] and appldr keys)

= Tools =

== Official tools ==

=== make_edata_npdrm version 1.0.0 ===

Found in SCE PS3 SDK 1.92.

=== make_edata_npdrm version 4.0.0.W ===

make_edata_npdrm version 4.0.0.W (2009-02-15)

Found in SCE PS3 SDK ?4.00?

<pre>
make_edata_npdrm -h
make_edata_npdrm: version 4.0.0.W
usage:
  make_edata_npdrm [-options] <input file> <output file>

options:
  -h, --help     : print this usage and exit
  -v, --version  : print program version and exit
  -p, --progress : print progress [%]

  [create option]
  -b <size(KB)>  : block size (default 16, max 32)
  -z, --compress : data compress

  --format1      : old format (compatible with SDK 2.1x or older)
  --format2      : old format (compatible with SDK 3.0x or older)
  --format3      : old format (compatible with SDK 3.7x or older)

  [extract/check option]
  -x, --extract  : extract raw image from developing EDATA
  -i, --info     : print file information
</pre>

== Unofficial tools ==

make_npdata by Hykem

True Ancestor EDAT...


{{File Formats}}<noinclude>[[Category:Main]]</noinclude>